PG-2353: GitHub OIDC role for the PPG OL10 AMI factory

[nogueiraanderson]

Feature

• Add the gha_ppg_ami_factory GitHub-OIDC role (via the github-oidc-role module) that the AMI-build workflow assumes, plus a pre-created egress-only builder security group.

Why

• Lets the factory authenticate with no static keys and build over SSM Session Manager (no inbound SSH).
• Least-privilege: SSM scoped to AWS-StartPortForwardingSession; RunInstances, terminate, and deregister gated on iit-billing-tag; no SG-mutation perms since the SG is pre-created.

Tickets

• PG-2353 (this), PS-11252 (tracking). Companion: jenkins-pipelines#4168 (factory + workflow).

[nogueiraanderson]

Apply notes

• Apply in the CI build account where the factory bakes and the molecule jobs run (the token.actions.githubusercontent.com OIDC provider already exists there).
• A ppg-ami-builder-ssm role + instance profile were created manually during end-to-end testing, so tofu apply will hit EntityAlreadyExists on that resource. Delete the manual pair or tofu import it before applying.
• After apply, set the Percona-Lab/jenkins-pipelines repo secret PPG_AMI_FACTORY_ROLE_ARN to the ppg_ami_factory_oidc_role_arn output.
• The OL10 vmimport role + import bucket are intentionally outside this module (one-time operator bootstrap via just bootstrap-ol10-prep). just ci passes locally (tofu validate: 4 resources valid).